Mailman 3 October 2017 - Mailman-Users

ModSecurity false positive on list options pages
by Russell Clemings 10 Oct '17

10 Oct '17

Using OWASP ModSecurity Core Rule Set ver.3.0.2 on cPanel v66.0.23; CentOS 7.3, Mailman 2.1.23: ModSecurity with the OWASP rules (which come with cPanel nowadays) doesn't like Mailman's list options url for some email addresses. Specifically a URL in the form http://lists.xxx.xxx/mailman/options/listname/localpart--at--domain.com is blocked with a 403 error. Only '.com" addresses are affected, as far as I can tell, and the reason is rule 920440: SecRule REQUEST_BASENAME "\.(.*)$" "chain, capture, phase:request, t:none,t:urlDecodeUni,t:lowercase, block, msg:'URL file extension is restricted by policy', severity:'CRITICAL', rev:'2', ver:'OWASP_CRS/3.0.0', maturity:'9', accuracy:'9', id:920440, logdata:'%{TX.0}', tag:'application-multi', tag:'language-multi', tag:'platform-multi', tag:'attack-protocol', tag:'OWASP_CRS/POLICY/EXT_RESTRICTED', tag:'WASCTC/WASC-15', tag:'OWASP_TOP_10/A7', tag:'PCI/6.5.10',logdata:'%{TX.0}', setvar:tx.extension=.%{tx.1}/" SecRule TX:EXTENSION "@within %{tx.restricted_extensions}" "t:none, setvar:'tx.msg=%{rule.msg}', setvar:tx.anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.%{rule.id }-OWASP_CRS/POLICY/EXT_RESTRICTED-%{matched_var_name}=%{matched_var}" tx.restricted_extensions, defined elsewhere, lists a lot of file extensions, .com being among them: 'tx.restricted_extensions=.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/' So basically ModSecurity sees .com at the end of the URL and thinks a risky file is being requested and blocks the request. With some help from the OWASP list I wrote a new rule that works around this problem. It is entered in the "ModSecurity Tools" section of cPanel's WHM. I don't know if there's a way to do it if you don't have access to WHM. I couldn't find one. SecRule REQUEST_URI "^\/mailman\/options\/.*" "id:900240,phase:1,nolog,pass,t:none,setvar:'tx.restricted_extensions=.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/'" That substitutes a new list of restricted extensions for requests to a page containing the "/mailman/options/" string. Now: http://lists.xxx.xxx/mailman/options/listname/localpart--at--domain.com is admitted http://lists.xxx.xxx/mailman/Xoptions/listname/localpart--at--domain.com is blocked I'm posting this mostly for the sake of anyone else who runs into this problem. If there's a simple fix on the Mailman side, though, so much the better. Maybe substitute another character for the dot?

2 1

Re: [Mailman-Users] cause of bounces
by paul＠tokyoprogressive.org 10 Oct '17

10 Oct '17

EMAIL tokyoprogressive(a)mailbox.org paul(a)tokyoprogressive.org - - - - - - - - - - - - - - - - - - - - - - NEWS AND ACTIVISM http://tokyoprogressive.org MUSIC http://paularenson.org - - - - - - - - - - - - - - - - - - - - - - Phone/Voice Mail 050-5308-5394 From abroad 81-50-5308-5394 Phone/SMS 090-4173-3873 From abroad 81-90-4173-3873 Contact via LINE is also possible. - - - - - - - - - - - - - - - - - - - - - - > On Oct 10, 2017, at 23:57, paul(a)tokyoprogressive.org wrote: > > Thank you, Mark. All the options look bad (except telling people to use another email provider). > > > OPTIONS > A few are unclear, such as RESTARTING Mailman. How does one restart it? I use Cpanel and do not know the inner workings. > > Which do you think it the best of the suggestions? I already have content filtering set to off to allow attachments. And there is currently only a footer that says: > > _______________________________________________ > Galeexec mailing list > Galeexec(a)gale-sig.org <mailto:Galeexec@gale-sig.org> > http://mail.gale-sig.org/mailman/listinfo/galeexec_gale-sig.org <http://mail.gale-sig.org/mailman/listinfo/galeexec_gale-sig.org> > > > Again, the list is REPLY TO LIST. > > > IS IT ONLY YAHOO ADDRESSES? > > I found another article that makes me wonder— https://www.pcworld.com/article/2141120/yahoo-email-antispoofing-policy-bre… <https://www.pcworld.com/article/2141120/yahoo-email-antispoofing-policy-bre…> > > it says "List subscribers with email accounts on servers that perform DMARC checks, such as Gmail, Hotmail (Outlook.com <http://outlook.com/>), Comcast or Yahoo itself, will reject the original message and respond back to the list with automated DMARC error messages"……. making it seem that all of these providers are no-nos. > > But later it says "So users of Gmail, Hotmail and other DMARC-enabled providers will not only fail to receive messages sent to the mailing list by Yahoo users, but will flood the list with bounce messages, risking to be bounced off the list themselves”. > > > This sentence seems to imply that it is YAHOO users who should switch. But the previous quote implies people with all of those providers should switch. > > > Can you give me your opinion. Is it Yahoo that is breaking mailing lists, or is it Yahoo, Gmail and Hotmail? > > > Thanls > > > > > > >> On Oct 10, 2017, at 21:58, Mark Sapiro <mark(a)msapiro.net <mailto:mark@msapiro.net>> wrote: >> >> On October 9, 2017 11:56:02 PM PDT, paul(a)tokyoprogressive.org <mailto:paul@tokyoprogressive.org> wrote: >>> Hi and hope the answer(s) to my question are relatively simple. On one >>> of two lists I manage, some people are getting deleted due to too many >>> bounces. And the bounces seem to be related to their mail provider not >>> allowing the messages. As far as I can tell, the main culprits are >>> gmail, yahoo, and hotmail. >> >> >> I think this is a DMARC issue. See <https://wiki.list.org/x/17891458 <https://wiki.list.org/x/17891458>>. >> >> >> >> -- >> Mark Sapiro <mark(a)msapiro.net <mailto:mark@msapiro.net>> >> Sent from my Not_an_iThing with standards compliant, open source software. >

2 1

Mail delivery or sending issues and list reply settings
by paul＠tokyoprogressive.org 10 Oct '17

10 Oct '17

Hi and hope the answer(s) to my question are relatively simple. On one of two lists I manage, some people are getting deleted due to too many bounces. And the bounces seem to be related to their mail provider not allowing the messages. As far as I can tell, the main culprits are gmail, yahoo, and hotmail. Of course, those people blame Mailman. From what i have read, it is not necessarily that. But complicating things is that people were complaining that the default REPLY to SENDER was not appropriate for a discussion list, so I just switched it over to REPLY TO GROUP. I do not THINK that is the reason for the trouble, but here in the space of a few minutes are some of the messages I have gotten with my questions in caps. (On the other hand, we didn’t have this issue UNTIL I switched to reply to the list. So I am wondering if there IS indeed a connection. Also unsure if this is a problem with the user not being able to receive mail, send mail, or both so far). PROBLEM ONE: UNABLE TO SEND AND/OR RECEIVE EXAMPLES FROM YAHOO AND HOTMAIL a(a)yahoo.com <mailto:a@yahoo.com> host mta7.am0.yahoodns.net <http://mta7.am0.yahoodns.net/> [66.196.118.37] SMTP error from remote mail server after end of data: 554 5.7.9 Message not accepted for policy reasons. See https://help.yahoo.com/kb/postmaster/SLN7253.html <https://help.yahoo.com/kb/postmaster/SLN7253.html> SEEMS TO BE YAHOO DOES NOT LIKE MAILMAN AND ALSO SHE CANNOT ADD MAILMAN TO A WHITE LIST (YAHOO DO NOT HAVE!!!!).—> IS IT POSSIBLE SHE IS USING A MAIL CLENT THAT DOES NOT SEND CORRECTLY? OR IS THIS THE YAHOO INTERFACE? IS THIS HER MESSAGE BEING SENT OR HER MAIL PROGRAM NOT ACCEPTING MESSAGES? RELATED TO THIS: Some people are getting unsubscribed as a result: List: Galeexec Member ie(a)hotmail.com <mailto:mccandie@hotmail.com> Action: Subscription disabled. Reason: Excessive or fatal bounces. CAUSE OF ALL THE ABOVE? SOLUTIONS—BY LIST OWNER? BY MEMBER? NEXT EXAMPLE OF SAME hn(a)hotmail.com <mailto:hn@hotmail.com> host hotmail-com.olc.protection.outlook.com <http://hotmail-com.olc.protection.outlook.com/> [104.44.194.233] SMTP error from remote mail server after end of data: 550 5.7.0 (SNT004-MC7F11) Unfortunately, messages from (199.223.209.221) on behalf of (yahoo.com <http://yahoo.com/>) could not be delivered due to domain owner policy restrictions. SAME THING? I note the user has a hotmail address. CAUSE OF THE ABOVE? SOLUTIONS—BY LIST OWNER? BY MEMBER? BELOW THAT IS MORE INFO (RELATED TO THE ABOVE?) RESPECTIVELY Action: failed Final-Recipient: rfc822;ya(a)yahoo.com <mailto:quenbya@yahoo.com> Status: 5.0.0 Remote-MTA: dns; mta7.am0.yahoodns.net <http://mta7.am0.yahoodns.net/> Diagnostic-Code: smtp; 554 5.7.9 Message not accepted for policy reasons. See https://help.yahoo.com/kb/postmaster/SLN7253.html <https://help.yahoo.com/kb/postmaster/SLN7253.html> Action: failed Final-Recipient: rfc822; hn(a)hotmail.com <mailto:hn@hotmail.com> Status: 5.0.0 Remote-MTA: dns; hotmail-com.olc.protection.outlook.com <http://hotmail-com.olc.protection.outlook.com/> Diagnostic-Code: smtp; 550 5.7.0 (SNT004-MC7F11) Unfortunately, messages from (199.223.209.221) on behalf of (yahoo.com <http://yahoo.com/>) could not be delivered due to domain owner policy restrictions. There are others like this and they all share one of the two providers. PROBLEM TWO Though GMAIL USERS have reported messages in SPAM. No errors messages to the list. CAUSE OF THE ABOVE? SOLUTIONS—BY LIST OWNER? BY MEMBER? Thank you very much. Paul Arenson Japan

1 0

openrc init.d script
by Ruben Safir 06 Oct '17

06 Oct '17

I wrote an init.d script for mailman for openrc and I have bug I can't track down in mailmanctl when I run the script it feeds me this: www3 ~]# /etc/init.d/mailman start Go find the config Yo - go find /usr/lib/mailman/Mailman/mm_cfg.py * Starting mailman ... PIDFILE /var/lib/mailman/data/master-qrunner.pid PIDFILE /usr/lib/mailman/bin/mailmanctl * start-stop-daemon: fopen `/var/lib/mailman/data/master-qrunner.pid': No such file or directory * Detaching to start `/usr/lib/mailman/bin/mailmanctl' ... Starting Mailman's master qrunner. [ ok ] [www3 ~]# Traceback (most recent call last): File "/usr/lib/mailman/bin/mailmanctl", line 556, in <module> main() File "/usr/lib/mailman/bin/mailmanctl", line 412, in main fp = open(mm_cfg.PIDFILE, 'w') IOError: [Errno 13] Permission denied: '/var/lib/mailman/data/master-qrunner.pid' the file permissions look right: [www3 ~]# ls -al /var/lib/mailman/ total 48 drwxrwsr-x 10 mailman mailman 4096 Oct 25 2015 . drwxr-xr-x 28 root root 4096 Oct 2 16:03 .. drwxrwsr-x 4 root mailman 4096 Oct 8 2014 archives -rw------- 1 mailman mailman 27 Oct 25 2015 .bash_history drwxrwsr-x 2 root mailman 4096 Oct 6 16:28 data drwxrwsr-x 5 root mailman 4096 Apr 2 2017 lists drwxrwsr-x 3 mailman mailman 4096 Oct 20 2015 .local drwxrwsr-x 2 root mailman 4096 Oct 6 16:30 locks drwxrwsr-x 2 root mailman 4096 Mar 5 2016 logs drwxrwsr-x 12 root mailman 4096 Jan 1 2016 qfiles drwxrwsr-x 2 root mailman 4096 Oct 8 2014 spam -rw------- 1 mailman mailman 601 Oct 25 2015 .viminfo [www3 ~]# ls -al /var/lib/mailman/data/ total 92 drwxrwsr-x 2 root mailman 4096 Oct 6 16:28 . drwxrwsr-x 10 mailman mailman 4096 Oct 25 2015 .. -rw-r----- 1 root mailman 41 Jan 1 2016 adm.pw -rw-rw---- 1 mailman mailman 2642 Apr 15 12:47 aliases -rw-r----- 1 mailman mailman 12288 Apr 15 12:52 aliases.db -rw-rw---- 1 mailman mailman 34742 Mar 16 2017 bounce-events-09990.pck -rw-rw-r-- 1 mailman mailman 2390 Jun 11 03:13 heldmsg-hangout-122.pck -rw-r--r-- 1 root mailman 10 Jan 1 2016 last_mailman_version -rw-r--r-- 1 root mailman 5 Oct 6 16:28 master-qrunner.pid -rw-r--r-- 1 root mailman 14100 Oct 8 2014 sitelist.cfg And what really puzzles me is the error line on the trace /usr/lib/mailman/bin/mailmanctl omask = os.umask(6) try: fp = open(mm_cfg.PIDFILE, 'w') print >> fp, os.getpid() fp.close() finally: os.umask(omask) That file, mm_cfg.PIDFILE doesn't exist anywhere on the system. When you run it from the command line, it works without complaining. I think there is a problem with the permissions being created for the pid file. I would really prefer the pid file to be put in /var/run -- So many immigrant groups have swept through our town that Brooklyn, like Atlantis, reaches mythological proportions in the mind of the world - RI Safir 1998 http://www.mrbrklyn.com DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002 http://www.nylxs.com - Leadership Development in Free Software http://www2.mrbrklyn.com/resources - Unpublished Archive http://www.coinhangout.com - coins! http://www.brooklyn-living.com Being so tracked is for FARM ANIMALS and and extermination camps, but incompatible with living as a free human being. -RI Safir 2013

2 1

ZIP files in list-owner emails
by Lindsay Haisley 06 Oct '17

06 Oct '17

While our lists here are configured to reject ZIP file viral spam from subscribers or contributors, the same isn't true of the list-owner addresses, many of which redirect to Gmail accounts, and I get at least two or three Gmail notices a day informing me of the Google policy on this. Since they're touchy about stuff like this I'd like to reject these at the front door before they get re-mailed to list-owners. Is there a good way within Mailman to filter list-owner email for unwanted attachments? -- Lindsay Haisley | "The first casualty when FMP Computer Services | war comes is truth." 512-259-1190 | http://www.fmp.com | -- Hiram W Johnson

2 1

Filtering of unwanted Spam-Emails
by Sebastian Jung 05 Oct '17

05 Oct '17

Hi all, I administrate a Mailinglist where by default only members of the list are allowed to post messages. Lately we have Spam-Emails where the creator uses a "From"-Adress in the form of: regularListMember(a)somedomain.com <someSpamAddress(a)dubiosDomain.TLD> Mailman does not block those Emails since the known and allowed Email-adress appears with in the From-Field although it is just part of the name tag. Do you know, if there is some option to deal with the problem or to set a regular-expression to filter out such unwanted mails? Thanks in advance Sebastian

3 2

Django
by Ruben Safir 05 Oct '17

05 Oct '17

I'm not sure why you decided to add Django as a dependency of Mailman but it is a losey idea to add an additional entire operational development platform in order to just get a mailing list up and running. It is bad enough that the mailman python modules are constantly pinning the CPUs of my systems, but adding Django not only means having to completely rework my apache server configuration, which is strangely enough is not running for the sole purpose of being used as an adjunct to the mail list, but to force feeds an unwanted enormous security hole since it is a development platform which is exposed to the public. -- So many immigrant groups have swept through our town that Brooklyn, like Atlantis, reaches mythological proportions in the mind of the world - RI Safir 1998 http://www.mrbrklyn.com

8 12

2.1 installation instructions
by Ruben Safir 03 Oct '17

03 Oct '17

I am porting my mailman config to a new system using openrc and, if it is possible, I would like to be pointed to installation and configuration instructions for mailman 2.1.24 and postfix thank you -- So many immigrant groups have swept through our town that Brooklyn, like Atlantis, reaches mythological proportions in the mind of the world - RI Safir 1998 http://www.mrbrklyn.com

2 1

DKIM / DMARC woes...
by Grant Taylor 03 Oct '17

03 Oct '17

Hello, Does setting from_is_list and / or dmarc_moderation_action to munge cause Mailman to do anything with existing DKIM-Signature headers? Will they be removed or left there? -- Grant. . . . unix || die

2 6

2.1 installation instructions
by Ruben Safir 03 Oct '17

03 Oct '17

I am porting my mailman config to a new system using openrc and, if it is possible, I would like to be pointed to installation and configuration instructions for mailman 2.1.24 and postfix thank you -- So many immigrant groups have swept through our town that Brooklyn, like Atlantis, reaches mythological proportions in the mind of the world - RI Safir 1998 http://www.mrbrklyn.com

2 1

Mailman-Users October 2017